Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: One Click Translate

CRITICAL RISKRemoved from Chrome Web Store

One Click Translate

ID: anhjddeakbabimdgmonfbnpbainknbfa

Could be malicious

Extension Info & Metadata

Status

Removed

Version

1.1.6

Size

0.61 MB

Rating

4.6/5

Reviews

7,075

Users

350,991

Type

Extension

Updated

Mar 18, 2020

Publisher Contextual Analysis

Author: 42pxView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

538,809

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Translate your selected text with Google Translate in one click. Translation in a simplest way.

One Click Translate allows you to translate the selection text using Google Translate whenever you want. Select some text from a website, right click and select which language you want to translate to, we will popup a designated window to show you the result. You can add more languages or change the language translation order in our setting menu, or change the way you want to open the translation window. Translate the selected text with Google Translate There are too many websites on the internet and most of them bring you content in their native language. When you visit those sites, it becomes simply impossible to get the content you need or to understand where you need to go. In that case, you need some help with a quick translation. Of course you can use Google Translate, that is already an excellent Web service for translating snippets of text to and from languages. But it can be a fuzz in copy pasting text every time to translator. Google Translate is a trademark of Google Inc. The use of the trademark is subject to Google’s permission.

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical6

High3

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.1.6 Code review	10

Extension Version	Code Review Findings
1.1.6	10

Files with findings

2 distinct paths — top paths by unique finding count:

background.js9
_locales/en/messages.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Network Interception	critical	background.js (line 769)	The `combine()` function is the malware's control centre. It decodes the locale-hidden payload with `pay()` to get a config object, then registers a `chrome.webRequest.onHeadersReceived` listener (`dVal(upd.bro)[upd.t…	1.1.6
2	Network Interception	critical	background.js (line 732)	The `diff()` function registers `chrome.webRequest.onBeforeRequest` listeners (via `dVal(status.bro)[status.const]`) that intercept outgoing requests and rewrite URLs — adding, replacing, or stripping query-string par…	1.1.6
3	Obfuscation	critical	background.js (line 432)	Three interlocking obfuscation primitives: `base` is an alias for `atob` (base64 decode), `star` is a recursive function that applies `base` N times, and `pay` composes them to produce a double-base64-decoded, JSON-pa…	1.1.6
4	Obfuscation	critical	background.js (line 873)	Every 4 minutes (240,000ms), the extension reads ALL locale `messages.json` files, filters them using a modular arithmetic selector (`charCodeAt(0) % 5 !== 0`) to choose specific locales, concatenates the hidden `v.me…	1.1.6
5	Obfuscation	critical	_locales/en/messages.json (line 68)	The `en` locale file and every other locale file contains two extra non-standard keys `v` and `s` whose `message` values are thousands of characters of base64-encoded data — not translation strings. When concatenated …	1.1.6
6	Tracking	critical	background.js (line 785)	After a short delay, `combine()` injects a DOM element (`cert`, likely an `img` or `script`) into the page body (`doc[upd.by][upd.crt](cert)`) with its `src`/`href` set to URLs extracted from the decoded payload (`ht`…	1.1.6
7	Network Interception	high	background.js (line 704)	The `reponse()` function (misspelled intentionally to avoid detection) hooks `chrome.tabs.onUpdated` (via `dVal(time.key)[time.type]`) to intercept tab navigation events. For every URL matching strings in `inf`, it st…	1.1.6
8	Obfuscation	high	background.js (line 721)	The `dVal()` function resolves arbitrary dot-separated property paths on the `chrome` object at runtime (e.g., `dVal("webRequest.onBeforeRequest")` → `chrome.webRequest.onBeforeRequest`). All Chrome API calls in the m…	1.1.6
9	Unauthorized Data Collection	high	background.js (line 684)	The `fInfo()` function dynamically adds and later removes `chrome.webRequest.onHeadersSent` listeners (blocking mode) that modify outgoing request headers. Using the `dVal()` indirection wrapper to resolve all Chrome …	1.1.6
10	Remote Code Loading	medium	background.js (line 846)	The extension schedules a forced self-reload every 48 hours. This serves two purposes: it re-executes the `locales()` payload extraction (which runs 4 minutes after startup), allowing the operator to update the attack…	1.1.6

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


translate.google.com	-	https://translate.google.com/#auto/
*	/*	http:///
*	/*	https:///
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
bugzilla.mozilla.org	/show_bug.cgi	https://bugzilla.mozilla.org/show_bug.cgi?id=505521
microsoftedge.microsoft.com	/addons/detail/$%7Bchrome.runtime.id%7D%60	https://microsoftedge.microsoft.com/addons/detail/${chrome.runtime.id}`
chrome.google.com	/webstore/detail/$%7Bchrome.runtime.id%7D/reviews%60;	https://chrome.google.com/webstore/detail/${chrome.runtime.id}/reviews`;
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

4.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

sejauh ini ekstensinya berjalan sesuai harapan, praktis.. mantap.

Taufiq Ptu·9 Oct 2020

جيد

Abd Danger·8 Oct 2020

爲什麽一點作用都沒有???

WinGnik·8 Oct 2020

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

One Click Translate

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version10

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Growth

Rating Count

Average Rating

User Reviews